From 0d104838dcd19e7e943d4a3911e1b63c99eb719f Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Wed, 24 Jun 2026 12:35:26 -0400 Subject: [PATCH] ci: rewrite SSH module URLs to HTTPS in terraform-validate workflow In the GitHub Actions CI environment, the runner has no SSH key configured for github.e.it.census.gov, so 'terraform init' fails when pulling modules whose source URLs use the SSH git@ scheme (e.g. tags.tf, examples/simple/eks.tf). Changes made to .github/workflows/terraform-validate.yaml: 1. Added 'Setup GITHUB Credentials' step (CSVD/gh-auth@main) - Obtains a short-lived GitHub App token using the repository's GH_APP_PEM_FILE secret and GH_APP_ID / GH_APP_INSTALLATION_ID vars. - This mirrors the credential setup already present in the release workflow. 2. Added 'Configure Git HTTPS for Terraform module pulls' step - Runs: git config --global url."https://oauth2:@github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:" - This tells git to transparently rewrite any SSH git@ URL for this host to an authenticated HTTPS URL at the transport layer. - Terraform shells out to the system git binary for module fetches, so it honours this rewrite without any changes to .tf source URLs. No .tf files are modified: SSH source URLs in tags.tf and examples/simple/eks.tf remain intact so that developers using SSH keys locally are unaffected. --- .github/workflows/terraform-validate.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-validate.yaml index ac349eb..fbf70f3 100644 --- a/.github/workflows/terraform-validate.yaml +++ b/.github/workflows/terraform-validate.yaml @@ -13,6 +13,18 @@ jobs: - name: Checkout code uses: CSVD/gh-actions-checkout@v4 + - name: Setup GITHUB Credentials + id: github_credentials + uses: CSVD/gh-auth@main + with: + github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }} + github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} + github_app_id: ${{ vars.GH_APP_ID }} + + - name: Configure Git HTTPS for Terraform module pulls + run: | + git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:" + - name: Setup Terraform uses: CSVD/gh-actions-setup-terraform@v2 with: